2 ms·
Trusted Automated Exchange of Intelligence Information (Taxii) [pdf]
- 3767U6667765555 7y agoThrowaway account. What a disaster. This specification is brainchild of MITRE and DHS. I've worked in 4 info sec shops which have tried to implement this standard, and each time was worse than the last. STIX and TAXII 1.0 Only had working binds for Java. It was entirely possible to send insane sanitized data. Since you had to crawl a DOM like structure for relational data, you'd spend hours recursively resolving documents that may or may not exist in different levels or scopes. There's about 8 valid schema locations for retrieving indicators of compromise. After changing the valid top level attributes multiple times been STIX 1 and 1.2, we finally got mediocre Python binds. Then they torched the entire standard, moved it to JSON, made it graph resolve (AWESOME, I actually like this), and made real binds we could implement. ..EXCEPT THE IOCS ARE NOW ENCODED IN A DECLARATIVE PATTERNING LANGUAGE! How do I reliably get my intel out of freeform text!!!!??? Wasn't the purpose to easily share IOC? I don't want to have to write a million pattern resolvers. I had my hands busy just updating firewalls. Side rant, FS-ISAC had the only product that could ever parse STIX TAXII and they charge based on total revenue. A mom and pop might get charged $10k a year, but my F100 company they wanted $400k a year FOR A MONGODB DJANGO APP WITH A POOR CELERY BACKEND. End unprofessional rant. The opportunity to make a real difference in computer info sec is there for a company with the right value proposition, but it isn't in STIX, TAXII, or any of MITRE's well intentioned hellspawn standards. Years of my life wasted. As a former